4 ms·
What if your CA is down for a day? Imagine let's encrypt being down for 24 hours and all if it's certificates going invalid. That would be millions of websites
by elcomet 6y ago
What if your CA is down for a day?
Imagine let's encrypt being down for 24 hours and all if it's certificates going invalid.
That would be millions of websites unavailable..
- josephcsible 6y agoThis is no different than an OCSP server going down for a day. Either the site becomes unreachable, or clients take a risk by accepting a certificate that might be revoked.
- Avamander 6y agoWhen OCSP is down nothing happens with most browsers. Except-Staple might worsen it a bit, but how many use that?
- josephcsible 6y agoMy point is that connecting with OCSP down carries the exact same risk that accepting an expired certificate does. In both cases, the risk is that the certificate might have been revoked without you knowing it.